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b7E 


K M I \WI II ri I OK omt IAI I SI OM ^ ! 


I 1 v !<! * ^ v N v v as the system '\ c tU to t v | | 

associated with their specific ease. Access Is controlled via user access-level privileges 
and based on case specificity. 





Accordingly- if 

se system is designed so (hail 

i 





Connects to no other systems 


using no other means. 


b7E 


3 'Vcs v n\ ok on cel cA ecu uu\o d v»* ' oak -wn mio'^ iouvv 
individuals*' >?., a human being or van a! person, regardless of nationality)? 

_NO (If no, STOP- The FT A is now complete and after division approvals} 

should he submitted to FBI OOC/PC1.I.I for final FBI approval- Unless yon are 
otherwise advised, no PI A is r erpr? red. | 

.X.YES Ilf yes, plea se continue Personally identifiable infor mation may b e 

nmhdaincd in | |but the purpose of the system is to provide] | b7E 


3, Please Indicate if any of the following characteristics apply to the information in the 
system about individuals: Beat ' mind that log-on information may Identify or he 
linkable to an individual 
(Check all that apply,} 

. X .The information directly identifies specific individuals, 


(irNCLASblllEO / H>» OFFICIAL, USE OM V 
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> S S ' V V W S „ , V 0 W 

to indirectly identity specific individuals. 

X The information can be used to distinguish or trace an. .individual’;* identity (i.c.» it 
is baked or linkable to specific individuals). 

If you marked any of the above, proceed to Question 4, 

None of the abo ve, if none of the abo ve, describe why the information does not 
Ov ' \ n\\' ~ " v e „ v v X > V „ x E * ut\ 

STOP here after providing the requested dm'riplkm.f 


4. Does the systenDproject pertain only to government employees, contractors, or 
.X.NO .YES 


5. Is intbrmatson about United States c it mens or lawfully .admitted permanent resident 
aborts retrieved from the systern/project by name or other personal ide.nti.Oer? 

NO. | If no, skip to s|uestino ?V| 

X YES. [If yes, proceed to the next question,] 


6. Does the sy stem/project collect any information directly fVont the person who is the 
subject of the infbnnation? 

_NO [If no, proceed to question 7.J 

.X.YES 


a. Does the systera/prqiect support criminal. Cl", or FCI investigations or 
assessments? 

.NO 

X YES | If yes, proceed to questtou ?,j 


' \j mI as > * I ? ! Wh *> V a < , nr A w I 

provided a written Privacy Act (e)(3) statement (cither on the collection form or via a 
separate notice)? 


jUMILASSIIXED / FOE OFFICIAL USE ONLY] 
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jUNCLASSIFIED / FOR OFFICIAL USE ONLY! 


X NO {The program will m&4 to work with FC.'LU to deveiop/implemoni 
the necessary £oro?(s),j 


t dam a cm noted throa^f" 


Isncioding those which 


may comma personally identifiable inibnnation, will be reformed m die 
appropriate time pursuant to applicable law nod policy. 


YES Identity any .ferine,: paper or electronic, used to request such 
in formation from the inforomiion subject: 


■> s Y\ m, m \. x\- "W' ^ kxieo ' 0 e v ' m 

S l ^ W \ <. Ivinl v H <. 11 ! ’ 11 ^ 

_NO _X YES If yes, check all that apply: 


no\ o e tce\ v'- e.'U* ' ,u N I: ' de m ' ,'fr,\ • 
witnesses or sources in this lave enforcement or intelligence activity. 


SSNs are necessary t 


i.fy FBI personnel is this internal administrative 


X__ vSNa an: n no, etans tm Whet cv.vo Inscribe: 


,4s there is no cont rol over what data may he cap tained wlt.hio[ 
is plausible that tlu j j o my Include I b e subject N or 


]» 


other imltvidoals- social security numbers (SSNs), [_ 


3<sdf decs not 


specifteally collect or associate S SNs with othe r personally identifiable 
information. I f an SEN is part of| l it will only he attributable to a 

specific nerson f" I No SSNs are otherwise 

specifically stored or retrievable. 

X The system/project provides special protection to SSNs (e,g., SSNs arc 

' v \ i v : t >< > _ \ , > ' \ , e o o , \< i < v , e * s 

users). Desert be: | [ tod thus It is not 

feasible to completely negate the presence of SSNs, SSNs may be Included 
nod Its location is unknown an till | 

| |a.nd the cose 

agent ass igned to a particular ease have acccssj " ™ ] 

| | which |>otcutiaIly may contain SSNs. 


[UNCLASSIFIED ! FOB OFFICIAL USE ONLYj 

14-06-04-FBI-FOIA-20150417-5th-Production 


EPIC-1495 










jLNCXASSl'FfKO / FOR OFFICIAL LXF ONLY) 

h is not feasible for the system/prolec! to provide special protection to 
SSNs. Explain? 


8. Is the system operated by a contractor? 
.X.No. 


Yes. hiformatlon systems operated by contractors for the FBI may be 
considered Privacy Act systems of records. The Federal Acquisition. Regulation, 
contains standard contract clauses that must be included In the event the system 
collects, maintains or disseminates FI I and additional requirements may be 
Imposed as a matter of Department of Justice policy. Consultations with the 
o , ;' ,i O \ o-t. < \'tv.qu oc , ,m tu ' -oy v. 
system for the FBI. 


.NO If no, indicate reason; if C&A is pending, provide anticipated 

completion date; 

X YES If yes, please indicate the following. If known? 

Provide date of last €<&A eertifeatiun/remertiBeation? 

Con.fid en tlal ity ?_Low_XI ode rate _XJfi igh Imdell n ed 

Integrity; _Low _X„ModerMe High Undefined 

Availability; Low X Ain derate High Undefined 

.Not applicable - tins system is; only paper-based. 


10, is this systom/proleet the subject of an OIViB-300 budget submission? 
..X.NO 

.TFS If yes, please provide the date and name or 

tide of the OY! B submission; 
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f UNCLASS I FI El> / FOR OFFICIAL CSC ONLY) 


11. Does the system conduct data mining m defined in Section 804 of the 

Implementing Recommendations of the 9/1 i Commission Act of 2007, F.L. 1lb- 
33 (codified at 42 DSC 20OOee~3>? 

X NO 


YES If yes, please describe the data mining fuselims: 


12, Is dps a national security system (as determined by the SeeD)’? 

_X._NO .YES 

i 3, Stains of System/ Project; 

'This is a now system/ project in development, j If yon checked this block, 
STOP, Oh FTA is non complete and after division approvals) should fee 
submitted to FBI OGGPC t l for final FIII approval and determination if 
Pi A and/or other actions are repaired,] 


iL EXISTING SYSTEMS / PROJECTS 

1.. When was the system/'pmject developed? | |was placed into service in 

March 2005. 

2, 1 hs thd ssatendprojeet undergone any significant changes since April 1 ?, 2003? 

_NO [If no, proceed to neat question (IL3).] While the system may feature 

same technological components that have been updated since the conduct of the last 
privacy threshold assessment, none of these technological updates alter the core 
functions of the system m described. 


YES !f yes, indicate which of the following changes were involved (mark all 
changes that apply, and provide brief explanation for each marked change): 

A conversion front paper-based records to an electronic system. 

_A change from information in a format that is anonymous or non- 

identifiable to a formal that is identifiable io particular individuals. 

_ A. new use of m IT system/project, including application of a new 

technology ages hem nfomtahon n identifiable form is managed 

(For example, a change that would ornate s more open environment and/or 
avenue for exposure of data that previously did not exist.) 

|UN€LASSIF1F1> / FOR OFFICIAL USE ONLY) 
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\> w „ ' i is i r ' "> > > fo ! uh\ «. u > be> g 

merged, centra; Aid, or matched with other databases. 

_ A new method of authenticating the use of and access to 

information or identifiable form by .members of the public. 

__ A systematic incorporation of databases of information in. 

< „ o 1 o n " v. o o' > ■, * uc once \ ' N w 

A .new interagency use or shared agency function that resents in. 
new uses or exchanges of information, in i den titrable form. 

A change that results in a. new use or disclosure of in.forrna.5km in 
identifiable form. 

form being added into the .system/project. 

Changes do not mvolve a change in the type of records maintained, 
the individuals on whom records arc maintained, or the use or 
cl worn nuvd on fo' mlermaiwu 5'nun He mourns onnect. 

Other IFroskfe brief explanation!:; 

3. Does a PI A for this systenCprofoet already exist? 


Ante that a FTA was prepared* but, at that time, it was determined that a 
PIA mmkl not be necessary. The FTA seas signed in October 200'?, 



•. box hfo Cain $b.e m ihe PI \ 

b. Has the systeoVpmiec? undergone any sign.dka.rn changes since die P1A? 
_NO .YES 

I The FTA is now complete and after division approvals) should be submitted to 
FBI OEC/PQdi for final FBI approval amt determination if PI A and/or other 
.actions it re required, | 
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FBI PRIVACY THRESHOLD ANALYSIS (PI’A) 


NAME OF SYSTEM / PROJECT: Q 
BIKR FBI Utiique Asset ID: Pending 


Derived From: 

SYSTEM/PROJECT POC 

FBI OfitVPCLi: POC 

Classified By: 

\an ; ej | 

V 1 1 

Reason: 

Program Office: 1 1B 

i Pfione:f 1- 

Beda.vdfj On: 

Division: ITS D/Hum an Resources 

Room Number: iHH 73SD 


Application Support Unit (HRA.SU) 



1 ' : ° ne 'l_1 

Room Number: 1907 



FBI DIVISION INTERMEDIATE APPROVALS 



| Program Manager (or other appropriate 
i e.vectnive as Division determines) 

Division Pn 

[ 

vacy Officer 

| 

Program Division: 

Name: 

! Title: 

Signature: 
Date signed! 
Name: 

Title: 

f.. 

FStHQ Division: 

itsd 

%»«>4 1 

Signature: 



Date SignciT 7 

Date signed: 

9 . „ ; 

[ N«nof | 

Namej [ 


Title: Division Privacy Contact Ov’IO 


After all division approvals, forward signed hard copy pins electronic copy to FBI 
OOC/PCLL (JEM 7350). 

s i he FBI Privacy and Civil liberties Officer’s determinations, conditions, asid/br final approval 
will be recorded on the following page,} 
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FINAL FBI A PPRO VA L / DETERMINA 1 IONS / COND ITIONS: 


PIA is required by the E-Government Act. 

_PIA is to be completed as a matter of FBI/DOJ discretion. 

is PIA to he published on FBI.GOV (after any RMD FOIA redactions}? _Yes, No {'indicate reason): 


X_PIA is not required for the .following reason(s): 

_ System does not collect, maintain, or disseminate PIP 

_System is grandfathered (in existence before 4/17/2003: no later changes posing significant privacy risks). 

X domut'on m .he system recedes to internal got eminent ■ oerarmrs 

.System has been previously assessed under an evaluation similar to a PIA. 

_X No significant privacy issues (or privacy issues are unchanged). 

.Other (describe): 


Applicable SORN(s): F8T~0t)2, The FBI Central Records System, 63 Fed. Reg. 8671 (Feb. 20. 1998), as amended 66 
Fed. Reg. 8425 (Jan. 31,2001), 66 Fed. 17.200 (Mar. 29,2001), 66 Fed. Reg. 33,558 (June 22, 2001), 70 Fed. Reg. 
513, 17 (Feb 2C 15) 72 Fed Reg 3410 (Jan 2 s 2007) and DOJ-002, Department of Justice Compun Svste s 
Aeovrv and Access Record* 64 Fed Reg 73,585 (Dee 30, 1999), as amended 66 Fed Peg 8425 { an )i 2001' no 
"2 red. Reg. 3410 (Jan. 25. 2007). 

Notify FBI RMD/RIDS per MIOG 190.2,3? _x_Nq _Yes-See sample EC on PCUJ intranet website here 

hop:. dtome/fX.)/OGC'I.;rB/PCLU/PrivacyCivil%20Liberties8f)20Library/form formiog! 90-2-3_ec.wpri 


SORN SORN rt vision(s) required? > Xo Y es (Indicate revisions needed): 


Prepare'revise add Pnvacy Act (e)(3) statements for related forms? _ No x Yes (indicate forms affected): 

System shookI ha\e a Privacy Act (e)(3) statement at login. 1 

EBCC ib h c t^iUeoi d v thRMD ;o identify/resolve any Felt al records/eleet iiv e o i s v 

The syste n may contain Federal records whether or nor it contains Privacy Act requests and. in any event, a records 
schedule approved by the National Archives and Records Administration is necessary. RMD can provide advice on this | 
as well as on compliance with requirements for Electronic Recordkeeping Certification and any necessary updares. ! 

Other: 


f 

'Elizabeth Withneli, Acting Deputy General 

81 and Civil T. ibe; ’ties Officer 

Signature: /$/ sir 

Date Signed: 1 / 31/2011 ( 
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L INFORM M ION ABOU I THE SYS FEM / PROJECT 

L Provide a general description of the system or project that includes; (a) name of 
the system/projeet, Including associated acronyms; (b) structure of the 
system/project, lacladmg interconnections with other projects or systems; (c) 
purpose of the ssstem/projecl; id) nature of the information in the system project 
and how It will be used; (e) who will have access to the information In the 
system/project; (!) and the manner of transmission to ah users. 





|is in the process of| | 



| There is no ch; 

aftge in the information being collected, maintained or 


lissemmated; rather, | ] is being deployed on | 

Iwh ich will employ greater network security! 


b7E 


b7E 


j - ”” identities a user by his/her FB1NET 

v'”v< ~ j 1 e FBINET domain, No additional PIT ,s vO 1 a tea raainta:ned oi a ssen n d 

r ‘YN , -'L d 2 e]?miectcreah)rm}dm , oject developers are detailed i the y jeefs 

properties. [ p rovides a type of audit trail view where project 

developers can identify individual changes made (by title}, who made the change, arid when the 
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l tdenhfies the user through the user’s 

FBJNET domain username or through an alter native user name cre ated by the user. The user has 
the option of choosing which username 10 use. I ""lose r name identifies Individuals 

who modify requirements and other stored documents. ! b anturcs the history of each 

requirement, thus providing an audit log. 

[ .racks user account information, including 

the username and password (chosen by die individual user), und er direction o f the System 
Administrator. In addition to access irdbrrnation, user activity .off Js also maintained for 

audit purposes. | l asers can query project activities by the activity owner's username or 

first and hist name. 


2. Does the system/project collect maintain, or disseminate any information about 
individuals (i.e., a human being or natural person, regardless of nationality)? 

_NO (If no, STOP. The FT A is now complete and after division approvals) 

should be submitted to FBI 0GC7PC'LU for final FBI approval. Unless you are 
otherwise advised, no PI A is required.] 

X YES (If yes, please continued 

* | Co ntain login information and audit leas of the 

select individuals who access the | No other P'H is contained. in | | 


.3, Please indicate if any of the following characteristics apply to the information i a me 
system about individuals: Bear in mind that log-on information may identify or be 
linkable to an individual. 

(Check all that apply.) 

X_The information directly identifies specific individuals. 

X_the information is intended to oe used, in con unction with other data elements, to 

indirectly identify specific individuals. 

X The information can be used to distinguish or trace an individual's identity (i.e., it 
is linked or linkable to specific individuals). 

If you marked any of the above, proceed to Question 4, 

None of the above if none of the above., describe why the information docs not 
identity specific individuals cither directly or indirectly, fit'you checked this Item, 
STOP here after providing the requested description.] 
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I CLASSIFIED 

4. Does the sysiem/project pertain only to government employees, contractors, or 
consultants? 

.NO .X.YES 

5. Is information about United States citizens or lawfully admitted permanent resident 
a retries ed from ,he system. p v oject by name or other personal identifier? 1 

NO |If no, skip to question 7.) 

X YES. fit' yes, proceed to the nest question,) 

6. Does the system/project collect any information directly from the person who is the 
subject of the information? 

. NO |ff no, proceed to question 7,j 

X YES 


a. Does the system/projeci support criminal, CT, or FCI investigations or 
assessments? 

.X.NO 


YES i If yes, proceed to question 7.] 


b. Are subjects of information from whom the information, is directly collected 
provided a written Privacy Act (e)(3) statement (either on the collection form or via a 
separate notice)? 

X NO [Use program will need to work with PCLU to develop/Impiement 
the necessary form(s).) 

__YES Identify any forms, paper or electronic, used to request such 

information from the information subject: 

7, Are Social Security Numbers (SSNs) collected, maintained or disseminated from the 
system/project? Full SSNs should only be used as identifiers in limited instances. 

.X.NO .YES If yes, check ail that apply: 


epic.org 


14-06-04-FBI-FOIA-20150417-5th-Production 


EPIC-1304 












i n< i 


SSNs are necessary to estabiish/conflnn the identity of subjects, victims, 
witnesses or sources in this law enforcement or intelligence activity. 

SSNs are necessary to identify FBI personnel in this internal administrative 

system. 

SSNs are important for other reasons. Describe: 

The system/project provides special protection to SSNs (e.g., SSNs are 
encrypted, hidden from all users via a look-up table, or only available to certain 
users). Describe: 

It is not feasible for the system/project to provide special protection to 
SSNs. Explain: 

8. Is the system operated by a contractor? 

_X_No. 

Yes. Information systems operated by contractors for the FBI may be 
considered Pri vacy Act systems of records. The Federal Acquisition Regulation 
contains standard contract clauses that must be included in the event the system 
co llects, maintains or disseminates Hi and additional requirements may be: 
imposed as a matter of Department of Justice policy. Consultations with the 
Office of the General Counsel may be required if a contractor is operating the 
system for the FBI, 

9. Has the system undergone Certification & Accreditation fC&A) by the FBI 
Security Division (SecD)? 

. NO If bo, indicate reason; If C&A is pending, provide anticipated 

ebPipletiob date: 


X YES If yes, please indicate the following, if known: 

Provide date of fast C&A certificatioo/re-certdlcatioo: 

| was most recently certified and accredited on 
03/10/2005. There have been no other subsequent C&As since for reasons that 
could only be spe culated (l.c. the system fell off SecD radar). However, be cause 
the system is now | | hc 

system ss now undergoing recertification. 
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Confidentiality:_Low_Moderate X High_Undefined 

Integrity': .Low X Moderate.High.Undefined 

Avn.yab.IMty: X L ow Moderate ...'.High_Undefined 

Not applicable this system is only paper-based. 

10. Is this system/project the subject of an OMB-300 budget submission? 

_X_NO 


_YES If yes, please provide the date and name or 

title of the QME submission: 

11, Does the system conduct data mining as defined in Section 804 of the 

Implementing Recommendations of the 9/11 Commission Act of 2007, P.L. 1 i 0- 
53 (codified at 42 USC 2O0Gee~3)? 

X NO 


YES If yes, please describe the data mining function: 

12. Is tins a national security system (as determined by the SecD)? 

X NO __YES 

13. Status of System/ Project: 

_This is a new system/ project in development, [If yon chocked this block, 

STOP. The FT A is now complete and after division approvals! should be 
submitted to FBI OGCTPCLi for final FBI approval and determination if 
PI A and/dr other actions arc required.} 


IL EXISTING SYSTEMS / PROJECTS 

1, When was the system/project developed? 

| | was first deployed in 2005. b7E 

2. Has the system/project undergone any significant changes since April 17. 2003? 

NO [If no, proceed to next question {11.3).] 
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I M 1. \SSiHFD 


X YES If yes, indicate which of the following changes were involved (mark all 
changes that apply, and provide brief explanation for each marked change): 

A conversion from paper-based records to an electronic system. 

_______ A change from information in a format that is anonymous or ncn- 

identifiable to a format that is identifiable to particular individuals. 

A new use of an IT system'project, including application of a new 
technology, that changes how information in identifiable form is managed. 
(For example, a change that would create a more open environment and/or 
avenue for exposure of data that previously did not exist.) 

A change that results in information in identifiable form being 
merged, centralized, or matched with other databases. 

A new method of authenticating the use of and access to 
information in identifiable form by members of the public. 

A systematic incorporation of databases of information in 
identifiable form purchased or obtained irom commercial or public sources. 

A new interagency use or shared agency function that results in 
new uses or exchanges of information in identifiable form. 

_A change that results in a new' use or disclosure of information in 

identifiable form. 

_ A change that results in new items of information in identifiable 

form being added into the system/project. 

Changes do not involve a change in the type of records maintained, 
fine individuals on whom records are maintained, or the use or 
dissemination of information from the system/project. 

X Other (Provide brief explanationj: 

~| is in process of ] | 

There is no change in the info rmation being colle cted, maintained o r disseminated; rather, 
| is being deployed on | ~ 

[which will employ greater network security, [ 


3. Does a PIA for this system/project already exist? 
X _NO _YES 
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a. Provide daie/iitie of the PI A: 

b. Has the system/project undergone any significant changes since the PIA? 

. NO _YES 

[The PTA Is now complete and after division approvals) should fee submitted to 
FBI OGC/PCLIJ for .final FBI. approval and determination if PIA and/or other 
actions are required.| 
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(OGC/PCLU (Rev. 07/06/2010} 


FBI PRIVACY THRESHOLD ANALYSIS f PTA) 

(Equivalent to the DOJ Initial Privacy Assessment (3PA)) 

|NAME OF SYSTEM /PROJECT; DAVE (Distributed Application Virtual Environment ! I 

BIK. t * * »■» a \s ID > v i > s 


Derived From; 

SYSTEM/PROJ'FXT POC 

FBI OG€/P€L(j POC 

Classified By; 

Name: Lead IT'S | | 

Name- AGC| 1 

Reason: 

Program Office: Data Center Unit (DCli) 

Phone:1 1 

Declassify On; 

Division: PfSD 

Room Number: 7350 JET ! 


Phone: | | 



j Room Number: T 8054 



FBI DIVISION INTERMEDIATE APPROVALS 



o osm> v \f a age? qa ot 'ef apnropriate 
executive as Division determines! 

Division Privacy Officer 


Program Division: 
Information Technology 
Services Division 

CITSD) 

Signature: J | 

Signaled 

Date signed' /0/f//J> 

Name | 

Date signed: /'a/vsv>2t 

Name:| | 

Title; Unit Chief. Data Center Unit 

Title: Unit Chief, Vulnerability & 

Compliance Support Unit 

FBIHQ Division: 

! Signature: 

Signature: 


Date signed: 

Date signed: 


Name: 

Name: 


Title: 

Title: 
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FINAL FBI APPROVAL f DKIT-RMINATIONS / CONDITIONS:i 


PIA is required by the E-Government Act. 

pi \ - to >x c "' ! vL\* Us t ulu ■'* v B POJ d'x'vKn 

Is P1A to be published on FB1.GOV (after any RMO FOIA redactions}? _Yes. _No (indicate reason): 

X P1A Is not required for the following reason(s): 

n uoes i cone t »n. or otssemn an Pil 

s » < * > \ s i fore 1.7/2003; f cm: nit 

X Information in the system relates to internal government operations. 

System has been previously assessed under an evaluation similar to a Pi A. 

No r ca irivac i res r privacy issues are unc ! x 
X Other (describe): DAVE l | is a hostingenvironment for applications operating on the ) | the 

>rtly FR collected and maintained within DAVE is that, of a limited number of IT administrators and security personnel 
Nth access rights to the DAVE infrastructure. 


Applicable SORN(s): DOJ-002, Department of Justice Computer Systems Activity and Access Records, 64 Fed. Reg. 
73,585 (Dec. 30, i999), as ascended 6 6 Fed. Reg. 8425 (Jan. 31, 2001) and 72 Fed. Reg, 3410 (Jan. 25, 2007). 

Notify FBI RMD/RIDS per MIOG 190.2.3? ...X... No _Yes-See sample EC on FOLD intranet website here: 

http://home/DCFOGC/LrB/i > CUJ/PrivacyCivil%20ybe-ties%20i..ibrary/ldny5 for miogl90-2-3 ee.wpd 


SORN/SORN revision^} required? JL .. No 


Yes (indicate revisions needed): 


Prepare/revise/add Privacy Act (e)(3) statements for related forms? X No Yes (indicate for ms affec ted): 
PCI-U will work with the Program Manager to ensure that a Privacy Act (e)(3) statement appears on the l I nitial 
login screen. 


RECORDS. The program should consult with RMD to identify/resolve any Federal records/electronic records issues. 
The system may contain Federal records whether or not it contains Privacy Act requests and, in any event, a records 
schedule approved by the National Archives and Records Administration is necessary. RMD can. provide advice on th 
as well as on compliance with requirements for Electron ic Recordkeeping Certification a nd any necessary updates. 


Other 


Unit Chief, Privacy and Civil Liberties Unit 

S H 1 ' id*, Vi S> vy T 


Signature:/ 
Date SignefFT 


I/ACLaSM FlF.i) 
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INFORM ATI ON ABOUT IIIK SYSTEM / PROJECT 


L Provide a general description of the system or project that Includes: la) name of the 
' stem i r< o •> •, so lading assoc tied acronyms; (h) structure of the sten n <t c , 
including interconnections with other projects or systems; (e) purpose of the 
system/projeet; <d) nature of the information in the system/projeet and how it will fee 
used; (e) who will have access to the information so the system/projeet; (f) and the 
manner of transmission to ail users 

The Distributed Application Virtual Environment (DAVE) ! | provides IT 

^ ' o > >. server o ‘ % i < > r > 1 it 

I l ihe DAVE utilizes some cpmrncm infrastructure services, such as 

j [The DAVE management servers 

i provide intertaces/databases supporting the allocation of serve? and network resources and also 
support hw collection of pen'ormance statistics for the infract-ventre and hosted servers. The 
DAVE also supports FBI data center consolidation and reduces spending on physical server 
Nod ware ;md mahnwian-c 

All access to information contained in an application hosted on DAVE is controlled by 
te Heat 1 i x >.rthat reasoi Privacy Thre i 

, ) ' t ironment not. the vark i.eat hat 

hosted on DAVIE. Those applications will be the subject of separate PTAs. 

A select group of IT administrators have access privileges to the DAVE infrastructure 
id ope room sets :eir login information is stc* n I E1-, for securi pos 

>th .id? i access and vit >AVE does not collet 

disseminate personally identifiable information. 

I. Does the system/projeet collect, maintain, or disseminate any information about 
individuals (he., a human being or natural person, regardless of Rationality)? 

[ NO 

_YES [if yes, please continue.! 

* The only PH maintained in DAVE consists of access and activity information for the 
• i * dm > tiers o iih access priv 
infrastructure. 

on I «■ ic w ng ch,\ vtciiv at < ^ f t> t * \ 

? 1 e * < i << !!=?>> nkahk : 

individual. 

sCheck all that apply.) 
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X The information directly Identifies specific individuals. 

The information is intended to be used, in conjunction, with other data elements, to 
ndn pectiic mdmdua 

_\ The information can be used to distinguish or trace an individual's identity m it is 

linked or linkable to specific individuals). 

11'yon marked any of the above, proceed to Question 4. 

None of the above, if none of the above, describe why the information does not identify 
specific individuals cither directly or indirectly, flfyon cheeked this item, STOP here after 
providing the requested description.) 

4. Docs the system/project pertain only to government employees, contractors, or consultants? 

_NO N YES 

5. Is information about United States citizens or lawfully admitted permanent resident aliens 
retrieved from the system/project by name or other personal identifier? 

_NO. [If no, skip to question 

X YES. [If yes, proceed to the next question.} 

» The only PI I maintained in DAVE consists of access find activity information for the 
limited number of IT administrators with access privileges to the DAVE 
infrastructure. 

6. Does the system/project collect any information directly from the person who is the 
.subject of the information? 

X NO f if no, proceed to c|uestlon 7,J 

..YES 

a. Does the system project support criminal. CT. or FCI investigations os assessments? 
_NO 

YES [If yes, proceed to question 7,} 

' ' r i ohen t ie .nuemucon I>k ' > 

written Privacy Act (e)(3) statement (either on the collection form or via a separate notice)? 
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..NO film program will need to work wills PCLI) to deveiopAmpiemerd 

the necessary form(s)»f 

.YES identify ooy forms, paper or electronic, used to request sock 

mfarmssthm from ike Infomtation subject: 

7, Are Social Security Numbers (SSNs) collected, maintained or disseminated from the 
t s uh \8 id onh be used as Idmitti t 

X NO _YES If'yes, check all that apply: 

__.SSNs are necessary to estabiish/conlirm the Identity of subjects, victims, witnesses 

or sources in this law enforcement or intelligence activity. 

_SSNs are necessary to Identify FBI personnel in this internal administrative system. 

..._SSNs are Important for other reasons. Describe? 

_The system/project provides special protection to SSNs (e,g.„ SSNs are encrypted, 

hidden front all users via a look-up table, or only available to certain users). Describe; 

..it is not feasible for the system/projeet to provide special protection to SSNs. 

Explain: 

§. Is the system operated by a contractor? 

X No. 

.Yes. information systems operated by contractors for the FBI may be considered 

Privacy Act sy stems of records. The Federal Acquisition Regulation contains standard 
contract clauses that mast be Included In the event the system collects, maintains or 
disseminates Pi I and additional requirements may be imposed as a matter of Department 
of justice policy. Consultations with the Office of the General Counsel may be required 
If a contractor is operating the system for the FBI. 

9. lias the system undergone Certification & Accreditation (C&A) by the FBI Security 
Division (SecD)? 

_NO If no, Indicate reason; if C&A is pending, provide anticipated 

completion date: 

.X YES If yes, please indicate the follow ing, if known: 

h to sI .'0 , d , v cUaJm \ unw " 0: ' | t ,nr n o osmuUo 

•; AID) has been extended through Almost He 2014 at the e h'vooa nsk icxcis: 


LASsiHVO 
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I M'LAVxtt ?;•.$} 

Confidentiality: Low_Moderate X. High_Undefined 

Integrity; Low_Moderate X High.Undefined 

Availability; _Low Moderate X High_Undefined 

Not applicable - this system is only paper-based. 

10, Is this system/project. the subject of an OMB-300 budget submission? 

.X.NO 

YES If yes, please provide the date and name or 
title of the OMR submission: 

' S) 1 X . - * , >1 U y v A 1 t 1 

Recommendations of the 9/1 i Con -miss-on Act of 2007. P.L. 11.0-03 (codified at 42 USC 
2000ee-3}? 

X NO 

YES If yes, please describe the data mining function; 

12. Is this a national security system (as determined by the SecD}'? 

X NO ..YES 

13, Status of System/ Proj ect: 

This is a new system/ project in development. 

11. EXISTING SYSTEMS / PROJECTS 

1. When was the systern/pr ct deve „> \u 130.2010 

2 a '-'n’t * > et ; v » ' " ’i 1 v a . n v - v ' 1 ' 

_NO (If no. proceed to next question (IL3).j 

X. Y I :S if >es. indicate \\hieh of the Allow mg changes were sm <-l\ed (mark all changes 
that, apply, and provide brief explanation for each marked change): 

coBversio- from pape based ret xrdsto m eh on te r 


v\t t.AhAAtm 
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_t nge from information in a i * 4 ' tonym c a 

do m ah c o a *c\ n,u m \ nk « mb c ,o p w w L n ~i\ d\ J- 

'V new carol m 1 1 .■ys'.emprifeo; lo<u ludmg application ofot re* 

>wt' .'{"josh. w m; \ nut.on rudcmtVnie town <■ mu - u (Fen 

example, a change that would create a more open environment and/or avenue for 
>osure of dr it pre sly i not ex 

- - ge that es d si ml rmati r in identifiable b n: ?eir te i 
een . * r matched with database 

A new method of authenticating the use of and access to information in 
identifiable form by members of the public. 

A systematic incorporation of databases of information in identifiable 
form purchased or obtained from commercial or public sources. 

A new interagency use or shared agency function that results in new uses 
or exchanges of information in identifiable form. 

.. A change that results in a new use or disclosure of information in 

identifiable form. 

. A change that results in new items of information in identifiable form 

being added into the system/proieet. 

.X Changes do not involve a change in the type of records maintained, the 

indi vidua! s on whom records are maintained, or the use or dissemination of 
information from the system/projeet. 

.. Other f Provide brief explanation]:; 

Does a PI A for this system/proieet already exist? 

.X.NO .YES 


a. Provide date/tit le of the Pi A: 

i On siv s' s em pro cs unoeqgo v m signu art t Ganges once :l e Y \ 
.NO .YES 
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tASsim'D 


tOGC/**CLU {Rev. 07/06/2010) 


wm privacy rmmmQm analysis <rr a> 

Equivalent to the DOi initial Privacy .Assessment (IPA)} 


SAME OF SV8TEM/PRCMECT: DAVE (Distributed Application Virtual Eoviroumcm)£ 


BIRR FBI Unique Asset ID; N/A. Hosting Environments such as DAVE are not registered in BIRR. 


Derived From: 

SYSTEM/PRO,lEOT PO€ 

Classified By; 

Name: Lead ITS) 1 

Reason; 

Program Office: Data Center Unit 

Declassify On: 

Division: JTSD 


Phone:! i 


Room Number: IB054 


FBI OGC/ FCLU POC 
Name: AOCI 
Phone: I I 

Room Number 7350 JEH 


FBI DIVISION INTERMEDIATE APPROVALS 



Program Manager (or other appropriate 
executive as Dlvkslon determines/_ 

Division Privacy Officer 




- 

Program Division: 
Information 

Teeimulogv Services 
Division (ITSD) 

Signature: | j 

Signature: 

Date signed: fy/ %$ // 5 

Date signed: Y/ 2 YAA 


Name:| ! 

Name:) 

_ 1 

Title: Unit Chief. Data Center Unit 

Title: Unit Chief, Vulnerability & 
Compliance Support Unit 

FB.filQ Division: 

Signature.: 

Signature. 




Date signed: 

Date signed: 



Name: 

Name: 




Title: 

Title: 




iiisiissiiiiiii 
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?.!* : €LA$srn*;i> 


FINAL FBI APPROVAL / DETERMINATIONS / CONDITIONSt 


_PiA is required by the E-Cfovernment Act. 

' H V > x t ' V a M'JvU f Pi QOivi ><-' tsU 

Is IRA to be published on FBI.GOV i-after any RMD FOIA redactions}'? 


No (indicate reason): 


A PI A is not required for the Following reasonfs); 

_System does not collect, maintain, or disseminate Pit 

cm < dt < f, x v v bt i > < 1 ."‘n' es a !< i < p am n-4 

X Information in the system relates to internal government operations. 

$>' , >x revkmsK sesseti t , u <s s. < simil > a PIA 

N _J_ ssuc change 

X Other (describe): DAVE l I is a hosting environment for applications operating on the | | ihe 

< t v t of a limited numbe la r. f ' v persons 

■ css t el § v 


Applicable SORN(s): DO.M}02, Department of Justice Comparer Systems Activity and Access Records, 64 Fed, Reg, 
7335 (Dec.. 30, 1999% as amended 66 Fed. Reg. 8425 (Ian. 31, 2001.} and 72 Fed. Reg. 3410 (Jan. 25, 2007}. 

Notify FBI RMD/R1DS per MIOG 190.2.3? X No _Yes—See sample EC on PCLU intranet website here: 

htfo://hoine/DOAXJC/L'r.8.dhCLU/fh-ivacyCivii%2(>Ltbedies%20i.,ibrar>'-/fbrtn for mirtg 190~'N3_ee.svpd 

>RN/SOR > t v. v Y< licate n ts ueedt 


Prepare/revbe/add Privacy Act (e)(3) statements for related forms? X No _Yes (indicate fo rms affec ted): 

PCLU will work with the Program Manager to ensure that a Privacy Act (eX3) statement appears on the | ~| ioitk! 
login screen. 


RECORDS. The program should consult with RMD to identity rewfoe any Federtd records deeO'mnc records issues, 
-sn c vt ( ords whether os 11 t s Privacy Act t pa t >s * 

, < « sit ; < t i d * i > K ' h , l n s s , ,, t s ! v > ; s 

as well as on co mp lian ce with req u iremen t s for E lec t ronic Recordkeeping Certification and any necessary updates. 


Other: 


Qn.it. Chief, Privacy and Civil Liberties U 
FBI Privacy anc ivil 1 rsies < Ret 


Signatur 
Date Alette 




mcLAsnmm 
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L INFORMATION ABOUT TUI SYSTEM / PROJECT 


I ♦ Provide a general description of the system or project that Includes: (a) name of the 
sysfesa/projeefv including associated acronyms; (t>) structure of the systewi/projeet, 
Including Interconnections with other projects or systems; (e) purpose of the 
sr st m.Eprnjecf (d) nature of the Information to she system/projeef and hnw it will 
he used; («} who will have access to the tnfennatien m the system/projeet; (?) and 
the manner of transmission to oil users. 

The Distributed Application Virtual Environment (DAViip r p rovides IT 

u^A > a Awe re, ,wwr> <,\a« ! server arc hi tcctu j hosting v dual servers \ ihir 

|lhe DAVE utilizes some common infrastructure services, such as 
| The DAVE management servers 

provide iaterfoces/datahases supporting the allocation of server and network resources and also 
| > ‘ P 1 < > < 5 V t .’ > i l , < > o 'V' 

1 F ai i s 1 1 > i i * v i g ! < ices spendir A t cr 

t a tr < ' * ) 4 e 

All access to information contained in an application hosted on DAVE is controlled by 
the application, rather than DAVE. For that reason, this Privacy Threshold Analysts (FT A) 
addresses only the DAVE hosting us\ iui\) and not the various software applications that arc 
■v>sted s m DAVI: 1 h so . plk ations will be the subject of separate P 1 Vs, 

A ■, s , u u' I i i .Hors hauw - vile go 1 i i uriYastmetuu 

and management servers and their login information is stored h DAVE for security purposes, 
u khmuMum v \ * at s ik I > \ 11 eot> ri »! A a *. 
s > er: rail) cnti.fiablc i umatio. 

2. Bees the system/projeet collect, maintain, or disseminate any information about 
individuals (he., a human being or natural person, regardless of nationality}? 

|....NO 

_X.. YES ftf yes, please continue.] 

» I It PI s )AYI- consists ol access am o 

amwd orboi ol 1 Dm no some?', wd' access | wdegesiotA D\ I 
infrastructure, 

3. Please indicate if any of the following characteristics apply to the information in the system 
< * * are t lou o , > * , > r > amt I 

individual 
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UNCLASSIFIED 

(Check all that apply.) 

X F( ' , iirec?ly Mentil pecilk i idi\ * ! * 1 

I ats > 1 ' » \m on v 

indirectly identify specific individuals, 

.X t h c m v i,f » » mdK Id dent 

linked or linkable to specific individuals). 

If you marked any of the above, proceed to Question 4, 

None of the above. If none of the above, describe why the information. does not identify 
specific individuals either directly or indirectly. 

4. Does the system/projec? pertain, only to government employees, contractors, or consultants? 

.NO .X.YBS 

5. Is information about United States citizens or lawfully admitted permanent resident aliens 
retrieved front the system/project by .name or other personal identifier? 

_NO. (If no, skip to question 7.] 

X YES. {If yes, proceed to the next question,] 

* The only PII maintained in DAVE consists of access and activity information for 
the limited number of IT administrators with access pri vileges to the DAVE 
infrastructure, 

6. Does the system/project collect any information directly from the person who is the 
subject of the Information? 

. X. ... NO (If mi, proceed to question. ?.] 

_YES 

a. Does the system/project support criminal, CT, or PCI investigations or assessments? 
.NO 

YES fit' yes, proceed to question 7.| 

5 < » noun > t ' ,on uit tin tio w cjwu.Iv co I < , n eu 

otto . ‘ ■> m »v o.tl.ei the eolkvt on ora a a sonar notnc) 

bbCLAfiPFIEi) 
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_NO pile program will need to work will? PC Li to de vd op/imp foment 

the iieemary form(s),f 

.YES Identify any forms, paper or eleetrm.de, used to request seek 

Information front the Information subject" 

?. YreS dal keurib Number: (SSNs} collected, maintained o disscmtnatct iron the 
n/| " 1 ! ly be used as identifiers it » e ces 

X NO YES If yes, cheek all that apply: 

SSNs are necessary to estabhsb/conikm the identity of subjects, victi ms, witnesses 
<. t es in tl law enjf rcemtnts k diligence activit 

SSNs are neeessarv u> IdeuhE FBI persunnei in this internal adminkmuke system. 

SSNs are important lor other reasons. Describe: 

The sy.stem/project provides special protection to SSNs (e.g., SSNs ate encrypted, 
hidden from all users via a look-up table, or only available to certain users). Describe; 

It is not feasible for the system/project to provide special protection to SSNs, 

Explain: 

8, Is the system operated by a contractor? 

X No. 

_Yes. Information systems operated by contractors for the FBI may be considered 

Privacy Act systems of records. The Federal Acquisition 'Regulation contains standard 
contract clauses that must be included in the event the system collects, maintains or 
disseminates PH and additional requirements may be Imposed as a matter of Department 
of Justice policy. Consultations with the Office of the General Counsel may be required if 
a contractor is operating the system for the FBI. 

0 1 1m- ok v u as fo m s. t uo s.a> on A. 'Y.uuh s ots p A \ « t't 1 B1 Sou a A 

Division (Seel)}? 

.X. NO If bo. Indicate reason; if C&.A Is pending, provide anticipated 

completion date; 

_YES If yes, please In dir ate the following, if known; 

It is autic.tpat.ed that C&A lor DAVI j | will be completed in the Spring of 2014 at *>7E 

the following risk levels: 


i v t imm d 
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Confidentiality: 

_Low 

Moderate 

X High 

integrity: 

Low 

Moderate 

X High 

Availability: 

_Low 

_Moderate 

X High 


Not applicable ■ this system, is only paper-based, 

10. h * 'j\ -ten p - i.vtpe vs ;ev f 'as i >MB~ >00 AO_a s h umm ", 

.X.NO 

.YES If yes* please provide the date oik! name or 

tide of the OMB snbmfeskm: 

11. ) se m conduct data r sgas nsd in Section 804 * I r ^ v> 
Rcvom'uenJjt o?v ol d.e 9 ' \ Onum-Mor Vs o' 000“ P I 110-^ > uoddvo V t M 
2000ee-3}? 

X NO 

_YES If ves, please describe the data mining fonetion: 

2 Is his tnat o' county s> tern sdetr mins by th- SecD) 

.X NO .YES 

13, Status of System/ Project: 

X This is anew system/ project in development, [if yea cheeked tins block, STOP, 
The PTA is now complete and after division approvals) should he submitted to FBI 
OGC/PCLIJ for final FBI approval and determination if PIA and/or other actions 
are retgolred.j 

IL EXISTING SYSTEMS / PROJECTS 

1. Fher w ts th den a jeetdeve oped 

2. Has th e* >jec < ne any sig I ittee A 

_ NO [If n 'a i,< «e \ t ' I ) 

G S E >ev ntdie,m winch old > iowmg GvosgC'- vv e n ’ Imark ail ehang 
that apply, and provide brief explanation for each marked change): 

V , n hum rape: c ; . > o > i c>« s 

O^O.AaSO'IEO 
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A change from information in a formal that is anonymous or non- 
identifiable to a formal that Is identifiable to particular individuals. 

A new use of .an IT sy stem/project, including application of a new 
technology, that changes how information in identifiable form is managed, i For 
example, a change that would create a more open environment and/or avenue for 
exposure of data that previously did not exist.) 

_ A change that results in information in identifiable form being merged. 

centralized., or matched with other databases. 

_ A new method of authenticating die use of and access to information in 

identifiable form, by members of the public. 

A systematic incorporation of databases of information in identifiable 
form purchased or obtained from commercial or public sources. 

A new interagency use or shared agency function that results in new uses 
or exchanges of information in identifiable form. 

A change that results in a new use or disclosure of information in 
identifiable form. 

_A change that results in new Items of information in identifiable form 

being added into the system/project 

Changes do not involve a change in the type of records maintained, the 
individuals on whom records are maintained, or the use or dissemination of 
information from the system/project. 

_Other | Provide brief explanation j; 

3. Does a PI A for this system/project already exist? 

.NO .YES 


if yes: 

a. Provide date/fifle of the PI A: 


b. Has the system/protect undergone any significant changes since the P1A? 
NO_YES 


tAfLASStFtEn 
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^CLASSIFIED 


iOGC/PCLU (Rev. 07/06/2010) 


FBI PRIVACY THRESHOLD ANALYSIS (PTA) 

(Equivalent to tJhe DOj Initial Privacy Assessment (iPA)) 


NAME OF SYSTEM fPROJECT: Distribute d Application Vir tual Environment 

(DAVE)-I 


BIKR FBI Unique Asset II>; 


N/A. Hosting platforms such as DAVE are not required to be 
registered in BIKR. 


Derived Promt 

Classified By; 

Re&smr: 

Decksrily On; 

SYSTEM/P.RO<iECf POC 

FBI OGC/PCLU POC 

Name: 1TS[ | 

Name: AGCj | 

Program Office: Data Center Support Unit (DCSii) 
Division: O SD 

PhoneJ 1 

V •: Nun's lx ‘>1 BO 

Phonel 1 

Room Nu vibe;: i! H 7350 


FBI DIVISION INTERMEDIATE APPROVALS 



Program Manager (or other appropriate 

. 

Division Privacy Officer 

1 

Program Division: 
Information 

Technology Services 
Division (ITSD) 

Si an an; re(| ! 

Signature: | 

Date signed: 5(70 /p;e/o/ 

Date signed:* S'/ri/AcriV 

Na;ne:| \ 

lute: Unit Chief, DCSU 

Namd 1 

Title: Unit Chief Vulnerability Compliance 
Support Unit 

1 FliiiiQ Division: 

Signature: 

Signature: 


Date signed: 

Date signed.: 

1 

Name: 

Name: 

I.j 

Title: 

Title: 
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UNCLASSIFIED 


FINAL FBI APPROVAL / DETERMINATIONS / C ONDITIONS: 


_PIA is required by the E-Government Act. 

hi A is to be completed as a matter of FBI/DOJ discretion, 
is PIA to be published on FBI GOV falter any RMD FOIA redactions}? .Yes. 


: No (indicate reason): 


X.... PIA is not required for the following reasons}: 

System does not collect, maintain, or disseminate Pll 

System is grandfathered (in existence before 4/17/2003: no later changes posing significant privacy risks). 
X In ot sti ' the ss e elates t nt.es I >vernn h operations 

i i assessed under an Os < 1 r 

No _s s sacs isst sare c sge _ 

X Other: PAX"P I I is a hosting environment for applications operating on thc| | the only PH collected 
and maintained within DAVE is that of a limited number of l access rights 

to the DAVE infrastructure. 


\o> icable V)R\te Pt * -<’<'2 D opo. '>>n< > n/ o <v , t > 


/■ Nisf-o/rv .Vy/yt/y q/u/JroevA j?iVp/eA. M.BNL.Reg 


"3.5Xa.(Dec...3p,...fPyP),.a:; amended, 

Notify FBI RMD/RIDS per MIOG 190.2.?? ...X... No .Yes-See sample PC on PCL'U intranet website here: 

irttp:/.daonte/DO/OGC/L1Br1KlL.v1havacy<.Xvii%20fJherdes%20L'ibraiy/form..for...tr:u>g190"2--3..ec.vvpd 


SORN/SORN revision/*} required? X No .Yes 


Prepare/revise/add Privacy Act (e)(3) statements for related forms? 

PCL.U will work with the Program Manager to ensure that a Pr 
initial login screen. 


X No .Yes 

vacy Act (e)(3) statement appears on the DAVE 


RECORDS. The program should consult with RMD to identify/resolve any Federal records/electronie records issues. 
The system may contain Federal records whether or not it contains Privacy Act requests ami, in any event, a. records 
lule apprt s 4 ' .5 < s 1 u f < > ece i tdvic 

vt I as i o sp i « - reepn ' e : I *i Fk et tic Reeor ike pmc Certificau tut access pda 


Other: 


Monica E. Ryan, Unit Chief 
Privacy and Civil Liberties Unit 
FBI Privacv and Civil Liberties Offics 


Date Sitiued:' V 


>. ■■-••MEVfyy .. . 
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L INFORMATION ABOUT Till- SYSTEM / PROJECT 


Provide a general description of the system or project that includes: (a) name of the 
system/projeef, including associated acronyms; (b) structure of the sysiem/projeci, 
including interconnections with other projects or systems; (el purpose of the 
system/projeeft (d) nature of the information in the system/projeet and how It will he 
used; (el who will have access to the information in the systetn/projeet: (f) and the 
manor r of transmit don to all users. 


m-rzki 

•nr s i 


■rovides a virtual hosting 


The Distributed Application Virtual Environment (DAVE 

environment for various applications operating within the FBI _ 

domain.* The DAVE infrastructure provides a network and server architecture o n which to host 
virtual servers, 'The DAVE utilizes some common infras tructure services, such as I I 
| [ i he DAVE-spec.uk management servers 

provide intermcesklatahases to support the allocation of server and network resources and to 
support the collection of performance statistics for the infrastructure and hosted servers. The 
DAVE- also supports Data Center consolidation and reduces spending on physical server 
h nrdw ire an .1 maintenam *. 


Ail access to information contained in an application hosted on DAVE is controlled by the 
owner of the particular application, rather than by DAVE. For that reason, this Privacy 
Threshold Analysts (PTA) is limited to the DAVE hosting environment itself and does not 
encompass the various software applications hosted on DAVE. To the extent that particular 
software applications require privacy documentation, those applications will be the subject of 

wp ;\.v 


Access to the DAVE 


infrastructure and management servers is limited to 


approxim atehj lasskned to the USD's Data Center Support Unit (DCSU) 

along wlth | | assigned to the Security Division 

s ! cc nd acih rmation hose ind s is col ned 

within DAVIE as required, for IT support and security purposes. No personally identifiable 
no mati r (PII) sboat/othet td idu s is colter ed. t name tsec or dissernin ed b> 
DAVE' I I 


2. Does the system/projeet collect, maintain, or disseminate any information about 
individuals {Le., a human being or natural person, regardless of nationality}? 


_ YES [If yes, please continue.] 


’ Separate FT As ha 


ed for UK- DAVE hosting 
k-n-;uns 
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* The onh PH mamiaiued in D \Yh corneas ol' u-er access ana activity information Per 
the limited number of ITSD and SecD personnel with access rights to the DAVE 
infrastructure. 

3. Please indicate if an> of the following characteristics apply to the information in the 
system shout imlNidnals: Hear in mind that log-on information m.$> identify he hukabk 
to an individual, (Cheek all that apply.) 

X . 1 < l recti t’ a eci i da 

The information is intended to be used, in conjunction with other data elements, to 
' e dr pc i duals 

.X. The infonnation.can be used to distinguish or trace an individual's identity (i.e.. it is 

(inked or linkable to specific individuals). 

If you marked any of the above, proceed to Question 4. 

\0i e x l i v d ' c O 0 o. a v. Ov loU t \ i U 1 u i u s ^ u! .1 

specific individuals either directly or indirectly. 

4. Doe se s tern project p< in only p ver is 1 s, c 
consultants? 

_NO . X .YES 

b m n ttiort about I ntu! Maks i n/u* ■ »i lawkdk ..I'mlu n m iwi t ^sulurl 
aliens retrieved from the yysteas/projeet hy name or other personal Identifier? 

NO. [If no. skip to question 7. i 

X YES f'lfyes. proceed to the next question.] 

* The only PH maintained in DAVE consists of user access and activity information tor 
n.T r o a mmtv > ' s V d S cDpcmen! J 'ituu^rjs ,rc H\, 
infrastructure. 

6 Does the system/project collect any infonnation direct!) irons the person win is the 
subject of the information? 

X NO {If no. proceed to question 7,| 

.YEN 

a. Does the system/proiect support criminal. CT, or EC'! investigations or assessments? 
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I vn ySSi.f Ml,0 


Illlll 

b. Are subjects of information from whom the information is directly collected provided a 
written Privacy Act (e)(3) statement (either on the collection form or via a separate 
notice)? 

.NO [The program will need to work with P€LU to deveiop/implctncm 

the accessary tbrm{$),j 

YES Identity any forms, paper or electronic, used to request such 
information from the information subject: 

?. Are Social Security Numbers (SSNs} collected, maintained or disseminated from the 
system- project? Full SSNs should only be used as identifiers in limited instances, 

_ X .NO YES If yes, check all that apply: 

_SSNs are necessary to establish/confirm the identity of subjects, victims, witnesses 

or sources in this law enforcement or intelligence activity. 

_SSNs are necessary to identify FBI personnel in this internal administrative system. 

_SSNs are important for other reasons. Describe: 

.The system-project provides special protection to SSNs (e.g., SSNs are encrypted. 

hidden from all users via a look-up table, or only as aiSable to certain users). Describe: 

It is not feasible for the system ■■‘project to provide special protection, to SSNs. 
Explain: 

8. Is the system operated by a contractor? 

.X.No. 

_Yes. Information systems operated by contractors for the FBI may he considered 

Privacy Act systems of records. The Federal Acquisition Regulation contains standard 
contract clauses that must he included in the event the system collects, maintains or 
disseminates P1I and addit ional requirements may he imposed as a matter of Department 
of justice policy Consultations whit the <dike of the General Counsel may bo required if 
& contractor is operating the system for the FBI. 

9, Has the system undergone Certification <& Accreditation (C&A) by the FBI Security 
Division CSecD)? 
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i/'vu: ,™.:nr. 


X NO I) \\ i I h s ,, v ... s.v i't o .eo-; v on b7E 

date is not yet available. It is anticipate that DAVF ] | ill receive authority to 

operate CATO) at. the to!losing risk le\ els: 


Confidentiality 

: : Low 

Mi-derate 

...x. 

. High 

Integrity: 

_Low 

Moderate 

\ 

. High 

Availability 

Low 

Moderate 

X 

L High 


Not applicable - this system is only paper-based. 

10. Is tins system project the subject of an i >MB-300 budget submission? 

...... X...NO 

YES if yes, please provide the date and name or 
title of the OMB submission: 

11. Does the system conduct data mining as defined in Section $04 of the Implementing 
Recommendations of the 9/11 Commission Act of 200?, Pd.. 110-53 (codified at 42 USC 
2000ee~3)? 

_Y ES If yes, please describe the data mining function: 

12. Is this a national security system (as determined by the SecD) i 

X NO .YES 

13. Status of System/ Project: 

This is a new system/ project in development. 

II. EXISTING SYSTEMS / PROJECTS 

1. When was the system/project developed? DAY! | | s fir t deployed j Ociohct 2 ' b7E 

2. Has the system/project undergone any significant changes since April 17, 2003? 

X NO (If no. proceed to next question (11.3)4 

t here have been no significant changes to D.WE j M Tectmu the collection, 
retention., use or dissemination ol'Pii since it was first deployed. 
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YES If yes, indicate which of the follow mg changes were involved (mark all 
eh tg > *pp v id provide brief explar t 5 V 

A conversion iron' paper-based records to an electronic system. 

A change from information in a formal that is anonymous or non¬ 
ce, J, > ie io lo s ai s a •- < u so m 1 v ' » i 

A new use of an IT systenvproject, including application of a new 
technology. that change.^ Imw Information In mcmiftable form is maintged, (For 
example, a change that would create a more open environment and/or avenue to; 
exposure of data that previously did not exist.) 

\ change that est Its in in fort nation i t idenft lab e far, be ng rt erged, 
centralized, or matched with other databases. 

A new method of authenticating the use of atid access to information in 
identifiable form by members of the public. 

\ v Atm aw tree* >o- , mu A 1 ivam' \ or, oimu .» , be 
drt a purchased or oh tied 1 r m ercial or \ c so ees 

\ rem r » uhakv , w \ > t, <_ w . t! « ns t m' m 

or exc tat ges t S informatio: n J, n't lal e io t 

A change that results in a new use or disclosure of 1st formation in 
identifiable form. 

_ A change that results in new hems: of information hi identifiable form 

being added into the sy.Aem project. 

Changes do not involve a change in the type of records maintained, the 
mdiv iduals o-n whom records arc maintained. or the use or dis'Vtmnniion of 
information front the system/proteet. 

Other 1 Provide brief explanation]: 

3. Does a FLA for this sysiem/projeet already exist? 

X NO ._ YhS 


a. Provide date/tide of the P1A: 
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b. Mas i.hc svsiew/project undergone any Ags-incam changes since she FI A? 
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i m:i, assi fi 

FBI FTAi Digital Collection System (M'S 6080) 

(OGCPCU; t Rev OC16/2010} 

FBI PRIVACY THRESHOLD ANALYSIS (FTA) 

NAW OP SYSTEM PROdM }> OmnalfldUmkv..SwumstDCS){>000 


BIKR FBI Imique Asset IB; SY$«000002.1 


Derived From; 

SYSTI M PROJEC 1 POC 

FBI ogc/pcu; POC 

Classified Bv; 

Name: Electronics Eas'd 1 

Name: ACCI 1 

Betmso 

Program t)l ike 1 dccommunicatKtna 

Phoned 1 

f As bossily On; 

Intercept Collections Technology l nit 
(TICTU} 

Room Number: 7350 JIH 

S/A 

Du von Opctationa lech soloes l)i\ Coo 
Phone: 1 1 

Room Nsmtber: ERF A, 4.468 



FBI DIVIS ION INTERMEM ATP APPRO YA LS 



Program Manager tor other appropriate 

Division 501 . m-i ". 



evecunve as Div kr at determines)/ 



Program Division: 

Signature:] | 

Signalers 

:). 

Operational Technoloav 

Vate started! U } A /'A.C>? A ‘ 

Date s i or cu ; i} ,^,.v {g, v w 


Division tOTD) 

Name, SSAl f 

Name; SSrl f 


tide: Unit Chief. TICTU 

Title: Assistant Section Chief 

i'BIHQ Div avion: 

Signature: 

Signature: 


Date signed: 

Date signed 


Name: 

Name: 


fifko 

Title: 


After all division approval*, forward signed hard copy pins elect rook copy to FBI OGC/FCLF 
OEM 7350). 

(The FBI Privacy and Civil Liberties Officer's determinations, conditions, and/or final approval will be 
recorded on the following paged 
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FBI FT A:: Digital Collection System (DCS 60011} 


FINAL FBI APPROVAL / DETERMINATIONS / CONDrTION=S: 


X PIA is required by the E-Government Act. 

PIA is to be completed as a matter of FBI/DOi discretion. 

\ ' ' X ' ' V ' ' \ \' \ ' ' ' 


.X Ye 


: No (indicate r 


.. Pi A is not required for the following reasons): 

"• N S' s SS V l < 

.System is grand lathered (in existence before 4/; 7/200.3; no later changes posing significant priv 

information ; n fp c system relates to internal government operations. 

System has been previously assessed under an evaluation similar to s PIA. 

V V ' ' s . s ' W W ' ‘ ' ' V ' 

.Other': 


Appl icable SORNfo): PHI Central Rems 

Ftiendediq;6bimd,Ifog,.A.720qiM4!:,.2iJ 


ALiSTfoM!l(::002,Ol.Fe4ReeJ6fo/Jb7iifers.mj9P6) : 


V ‘ \ O' " ' 


I BLSUR) indices. It IS riCbddshAbty^Piijyrd, Pmi 7gij.ij:eb^].4,d005}. 

V ' ' O' < " x ' " " X No ^ N V " m 'v ' ' O m ' 

hnp homelKHKAM I'H IVfo Pshamo odfoNR foenwfo OOt Amy Rum fo. mmePfo? ' c\ opd 

' N \ N N , s s \ \ N ' x 


Prepare/n 

N/A 


e/add P 


• Act (e.}{3) statements for .related forms? 


No 


e fort' 


i affected;: 


RECORDS. The program shotdd consult, with RMD to identify/resolve any Federal records/electronie records Issues. 

T he system may contain Federal records whether or not h contains Privacy Act reqssesrs and. ;n any event, a records 
schedule approved by the National Archives and Records Administration is necessary. RMD cart provide advice on this 
npliance with requirements for Electronic Recordkeeping Certi float ion arid any necessatv updatetv 


Oilier: PCLi' will coordinate with OTB to ensure that a Privacy Impact Assessment (PIA) is prepared for the 
components of the Digital Collection System operated by 1101.1 (DCSNet, DCS POOP DCS 5000 and DCS 6000). 
This requirement may he satisfied fey a consolidated F1.4 discussing one or more components and separate FIAs 
for comommm b. that are not included In the consolidated PIA. 


_| Acting; Unit Chief 

tao and <jfol 1 dvrties I nh 


S-gnatnre 
Date Sfenem 


Jacqueline F. Brosvo... Acting Deptsty Gene: 
and FBI Privacy and Civil Liberties Off os 


Signature: *.*. 
ifembmofo yy\yU\yNN 
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FBI FT A; Digital < olketion System (DCS 6000} 


INFORM AI ION ABOl T 1'HE SYSTEM / PROJECT 


L Provide a general description of the system or project that includes: (a) name of the 
system/project, including associated acronyms; {!>} structure of the system project, 
Including interconnections vsiib other projects nr systems: (e* purpose of the systera/proj 
(d) nature of the information In the system/projeei and htm it ss dl he used: (e) w ho will 
tun c access to the information in the system/project; <f> and the manner of transmission 
ah users. 


ms Crime Control Act of 1968 (Till}, as am 
;trunk com munications as authorised by sva 


nuts the FB; 
DCS 6000 




-Production 




U N € I, .4.$ SIFI £ i 

FBI FT \: Digital Collection System <f>CS 6000} 

I I b7E 


2. Does, the system/project collect, maintain, or disseminate any information about individuals 
ii v.. a human being or natural person, regardless of nationality)? 

NO Iff no, STOP. The FT.4 is now complete and .after division approvals 
should he submitted to FBI OGC/PCLI for final FBI approval, Unless you ore other* be 
advised, no FI A is repaired.? 

_ X YES (If yes, please continue,! 

3. Please Indicate if any of the following characteristics apply to the information in the system 
about individuals: Bear in mind that log-on information may identify or be linkable to an 
individual. 

(( heck ail that apply * 

.X.The information directly identifies specific individuals. 

X The information is intended to be used, in conjunction with other data dements, to 
indirectly identify specific individuals. 

X The information can he used to distinguish or trace an individual's identity the., it is 
linked or linkable to specific individuals}. 

If you marked any of the above, proceed to Question 4. 

None of the above, if none of the above, describe why the information does not identity 
specific individuals either directly or indirectly. Ilf yon checked this Mem, STOF here after 
providing the requested description,! 

4. Does the system/pmjeci pertain only to government employees, contractors, or consultants ? 

X NO .YES 


t V 1 WAFF 
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Ml AsAIFf 

FBI FT A: Digital Collection System (DCS 6800) 

5. Is information about United States citizens or lawfully admitted permanent resident aliens 
retrieved from the system project by name or other personal identiiler? 

NO. [If no, skip to guest ion 7„| 

X YES. [If yes, proceed to the next question.) 

6. Docs the system/project collect any Information directly from the person who is the 
subject of the information? 

NO [If mu proceed to question 7,| 

X YES 

a. Does the systeni/project support criminal €T. or FCi investigations or assessments? 

...NO 

.X. YES [If yes, proceed to question 7.| 

b. Are subjects of information from whom the information is directly collected provided a 
written Privacy Act Ce'K'3) statement (either on the collection form or via a separate notice)? 

.NO [The program will need to work w ith PCLU to develop/implement 

the necessary fbrm(sy) 

YES identity any forms, paper or electronic, used to request such 
information from the information subject: 

7. Arc Social Security Numbers (SSNsj collected, maintained or disseminated from the 
system/prqjset? Full SSNs should only be used as identifiers in limited instances. 

.X .NO . ..YES If yes, cheek all that apply: 

i _ A file the DCS 6tK>0 is not designed to collect SSNs. they may be inadvertently collected 

| | Any SSNs obtained during conversations deemed *>7 e 

oonsvrtincm will he purged, m accordance with IS U.S.C. 5 2518(5) 

_SSNs are necessary to estahlish/eonlirm the identity of subjects, victims, witnesses 

or sources in this law enforcement or intelligence activity. 
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' ' ' 

FBI PTA: Digital Collection Systems UK'S 6009) 

V' \S „ sv. s ,s ' ' ' V - s "A v 

\s * v s Describe: 

\ - • S.V. V 'S. OSs. ' 'u S *^v v< 

*. ' V \ ' v V O' » ' *.V ' V N IVw MK 

‘ ' 0 N ' , ' \ " ' o ... \' ' ,V 00 Xv. V. ,' OW' 0 V ^N\\ 

Explain:: 

8. is the system operated by a contractor? 

.X.No, 

.Yes. lrrforr.nat.tan systems operated by contractors for the FBI may be considered 

Privacy Act systems of records. The Federal Acquisition Regulation contains standard 
contract clauses that must be included in the event the system collects, .maintains or 

. so' v. s < v*. *v »'0»' s ' ' V "00 v s ' 

x N to ' , s v ' ' v n' \ ' 0 \ s V . V v '' O' X 00v *0' ' 

a contractor is operating the system for the FBI. 

9. S v S V. s \ ' * o N ' v. ' \v 

Division {Seel))? 

NO If no, indicate reason; If C&A h pending, provide anticipated 
completion date; 

„JL_YKS if lyes, please indicate the following, if known: 

DCS 6000 was most recently reaeeredited on September 1,2. 2010 and has 
Authority to Operate (AID) through September 11, 2013. 

Confidentiality: .Low X Moderate High Undefined 

Integrity: _Law X Moderate High Undefined 

Ava.dah.dity; _Low X Moderate_High_Undefined 

Not applicable - this system is only paper-based. 

10. NS ' V S , V V ' ' ' ' " o 
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fwc las wild* 

FBI FT A i Digital Collection SjsSem {DCS 0000} 


NO 

X Y! S 


If yes, please provide the elate and name or 
title of the OMB submission: 

DCS 6000 is encompassed by the OMB 300 for FBI Digital Coikakm , forwarded by the 
I to DOJ on February 13, 2012, 

Does the system conduct data mining as defined in Section 804 of the Implementing 
Recommendations of the'd I. Commission Act of 2007, ILL. 110-53 (codified at 42 CSC 
2000ee-3}? 

X NO 

M S If yes, please describe the data mining function: 

Is this a national security system (as determined by the SecD}? 

X NO .YES 

Stems of System/ Project: 

This is a new system/ project in development. Ilf you checked this block, STOP- 
The FT A 1$ now complete and after division approvab sy should bo submitted to FBI 
0€-< PC LI tor final FBI appro* at and determination if PI A and or other actions 
are required,! 


It EXISTING SYSTEMS PROJECTS 

1. When was the system/project developed? DCS 6000 was first deployed in November, 1999, 

2. Has the system/projeet undergone any significant changes since April 17,2003? 

_ NO }ff no, proceed to next question {IO). j 


X YES If yes. indicate which of the following changes, were involved (mark all changes 
that apply, and provide brief explanation for each marked change}: 


\ con version I torn paper-based records to m electronic sysi 


mvLAMwmmous 
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A change from information in a format that is anonymous or non- 
identifiable to a format that is identifiable to particular individuals. 

_ A new use of an IT system/project., including, application of a new 

technology, that changes how information in identifiable form is managed. (For 
example, a change that would create a more open environment and/or avenue for 
exposure of data that previously did not exist) 

A change that results in information in identifiable form being merged, 
centralneed* or matched with other databases. 

A new method of authenticating the use of and access to information in 
identifiable form by members of the public. 

__ A systematic incorporation of databases of information in identifiable 

form purchased or obtained, from commercial or public sources. 

A new interagency use or shared agency function that results in new uses 
or exchanges of information in identifiable form. 

.. A change that results in a new use or disclosure of information in 

i dent i 11 able form. 

A change that results in new items of information in identifiable form 
being added into the system ■'project. 

.X. Changes do not involve a change in the type of records maintained, the 

individuals on whom records are maintained, or the use or dissemination of 
information from the system/projeet. 

_X_Other (Provide brief explanation] : Since its initial deployment in 1999. 

updates to DCS 6000 have invo ved w mr onherevmaow o; mpDcunonw w well 
as software (operating system } updates,| 


Does a HA for this system/projeel already exist? 
X HO __YES 
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FBI FTA: Digital Collection System IOC'S 6000) 


a, Provide date/iitfe of the Pi A; 

b. lias the svstem/projeet undergone any significant changes since the PI A? 

.. NO .YES 

A Privacy Threshold Analysis (FTA) for DCS 6000 was completed In April, 2007. 


[The FT A is non complete and after division approvals) shook! he sohndttcd to FBI 
OGC PC LI) for final FBI approval and determination If Fi.A and/or nthtt actions arc 
rep ni red, | 


N€LASMnrB//FOR0E 
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